The internet is a valuable and pervasive tool of modern commercial and consumer activities. A wide range of services, including important business and financial services, can be controlled and delivered via the internet.
However, these activities also create opportunities for computer related fraud, identity theft, and other criminal activities. Banks and other financial institutions have proved a target of many types of attack, including for example phishing, key loggers, ‘man in the middle’ attacks, and malicious software including various Trojans.
The current best practice approach for securing user accounts over insecure networks is to utilise a combination of SSL encrypted communications, user names, passwords known to the user, and a variable password, provided by a technique such as an RSA token or a one time password delivered by SMS. This approach is generally adequate to protect against normal phishing, key logger type or ‘man in the middle’ attacks.
However, malicious attacks have evolved to new levels of sophistication. Some extant Trojans facilitate HTML based attacks, for example what are known as ‘man in the browser’ attacks. In this instance, when the user attempts to contact a known bank website, the Trojan substitutes or alters the log in screen. A typical HTML log in screen provided by the bank site may include fields for input of the username, password and RSA token password. In one form of attack, an additional field is provided for the user to complete, for example labelled as ‘second token password’. The compromised interface sends the expected data to the internet banking server, which can operate and perform the required transaction as normal. The additional ‘second token password’ field value is not transmitted to the internet banking server, but is sent to an address designated by the malware originator. When coupled with the now known username and password, the second token value facilitates a new fraudulent transaction with the internet banking server. This may be completed by the fraudulent party immediately after the legitimate banking transaction is completed. This is only one example of many possible HTML based attacks. The key feature is that the HTML code is altered so that the customer at a remote computer does not see the interface exactly as intended by the bank, and that the changes assist in facilitating fraud.
One approach to detecting such attacks is to use a trusted software application on the client computer. Such an approach is disclosed, for example, in WO 2009/103742 by Boesgaard. However, in many cases it is not commercially acceptable or practical for a specific application to be resident on the client device.
It is an object of the present invention to provide a method and system to detect HTML based attacks at any client computer.